Feature Request: Sign the published workerd binary

Wrangler pops up with a "allow incoming network connections" modal because the workerd binary is unsigned. This appears practically every time you use Wrangler when using a Node.js version manager (e.g. nvm/Volta).

We should look into signing the workerd binary before publishing to npm (and elsewhere). We probably already have certs for the WARP client that we could maybe reuse?

cc. @admah